Malicious PDF — malware analysis report

Static analysis result for SHA-256 664018cb85384d89…

MALICIOUS

PDF

48.0 KB Created: 2020-10-26 16:30:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-02-23
MD5: 050552a09e9781b515991805becc58d2 SHA-1: b0ca2e1d95122ecf21d046fd1fa664aaf3562cf6 SHA-256: 664018cb85384d89afa2f8ee96711dfb8cf6e434e3a7f922c3c0d8d4824dd3e8
134 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/123?keyword=must%252Fcan%252Fmay%252Fhave+to%252Fcould%252Fbe+able+to%252Fshould+exercises+pdf In PDF document text
    • https://cdn-cms.f-static.net/uploads/4369334/normal_5f95a98f0a57f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366395/normal_5f88da17f0503.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365575/normal_5f8709212abe7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404297/normal_5f925e9f1ad13.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368468/normal_5f880e6265766.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370077/normal_5f896143a3d13.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/355184a1-acd0-484e-845a-4d4d7c7d698e/a_space_cushion_is.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f6dc5282-1326-4e84-a623-a30386bf271d/trk_mitolojisi_geleri.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/65713ff9-4f35-4412-85b5-d78a14323531/81488517356.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/030c7216-1c57-4262-a1ef-55dfb0deda53/luwotirusajusevatazuziwib.pdfIn PDF document text
    • https://s3.amazonaws.com/pisik/lead_acid_battery_charger_circuit_diagram.pdfIn PDF document text
    • https://s3.amazonaws.com/bawalidamovidud/logistics_and_supply_chain_management_mba.pdfIn PDF document text
    • https://s3.amazonaws.com/gogonof/adjective_clause_rules.pdfIn PDF document text
    • https://s3.amazonaws.com/satudifin/58452767918.pdfIn PDF document text
    • https://s3.amazonaws.com/vuraradaso/baixar_admirvel_mundo_novo.pdfIn PDF document text
    • https://s3.amazonaws.com/voxipanovigepiv/boolean_algebra_examples.pdfIn PDF document text
    • https://s3.amazonaws.com/degisapemifa/cerebral_palsy_articles.pdfIn PDF document text
    • https://s3.amazonaws.com/kavitokolezub/xibibutawasupafisazu.pdfIn PDF document text
    • https://s3.amazonaws.com/tetazino/rubezijuzozexiwaxuf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c6cea38f-f350-4fdf-ba91-2b0e21486f61/36610809378.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6d274e96-501a-408c-aaeb-91bc9d10ec16/18278005226.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/03b4c0c8-85c6-49aa-be55-7e7b3e22b695/introduction_to_aerospace_structural.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/95ce467f-e3fd-465f-bea0-b48854528614/resenafovatezekak.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/693a73fc-b373-4135-a60c-efcd4a2705a1/gijefeletil.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000079c7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x79C7 5804 bytes
SHA-256: 3cc3738fd97910c7509f9d9d733387563ce04e52db92dcafb79f4ecbf3fe1dd5
font_01_sfnt_off00008d73.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8D73 10816 bytes
SHA-256: a422fb6bad72bf739e74a215b9e0015688405cd2fe9b2cb5b1670704d18e2409

Open this report in the interactive analyzer, or submit your own file for analysis.